S s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s s
LosRightsFilter inasoma dirisha kupitia SessionPlatformFacts ya pamoja, ambayo sasa inahitaji pia. Serge Brammertz ni mtu mtulivu, aliye makini, lakini mwanashe...
Kanuni ya huduma iliyovunjika hujibu 409 kwa maneno yake mwenyewe, sio 500 (SITP TP22)
Huduma zinakataa isipokuwa wazi (offer lazima iwe DRAFT kutuma, kuteka itazidi mikopo Kikomo, sababu inahitajika, kitambulisho kisichojulikana, ambacho kilifiki...
Ada ya mkopo iliyopimwa inaweza kusomwa, hivyo ada inaweza kutajwa ili kuiondoa (SITP TP22)
[TD="width: 456"] [FONT=&](2)[/FONT][FONT=&]Bila kuathiri masharti ya kifungu kidogo (1) cha kifungu hiki, Tume itakuwa na mamlaka ya kuajiri mtaalamu yeyote kw...
Utoaji wa mkopo umeandaliwa tu kwenye bidhaa na mkopaji wa shirika, ripoti ya kuzeeka inahesabu tu mikopo yake, na vitendo vya wafanyakazi ni shirika (SITP TP22)
Post / api /los /offers: bidhaa lazima kuwa wito wa shirika na akopa mwanachama wa ni (au ya shirika la mtoto); mwili unataja bidhaa ya mpangaji mwingine au mwa...
KamoLOS inaangalia PLOS kulia na shirika kwenye kila njia, na kufungua mlango wa ufunguo wa wakati mmoja (SITP TP02)
KamoLOS ilisisitiza haki: wakala wa kamo-ndani / api /los alikuwa mlango pekee. Kwa sasa wanashinda Tumia meza ya wakala mwenyewe requiredRight (LosRights) kwa ...
Kuacha kuingia password database katika startup
com.zaxxer.hikari katika DEBUG hufanya HikariConfig kuchapisha usanidi wake wote kwenye kila mwanzo, ikiwa ni pamoja na DataSourceProperties {password=...} na n...
Nakala za Scrub za sifa za kuishi kutoka kwa config na dumps
Ufagiaji wa kila repo kwa maadili ya siri za moja kwa moja za kikundi (2026-09-23) kupatikana nakala hapa: Usajili wa siri wa JWT kama ' $ {JWT SECRET: <literal...
Uchunguzi wa maisha juu ya /actuator / afya / maisha, sio jumla ya DB- know
Jumla /actuator / afya ni pamoja na kiashiria cha DataSource, hivyo kuanzisha upya database kushindwa liveness juu ya kila pod mara moja na kuanzisha upya nzima...
Kutoa uhusiano wa Hikari sasa kwamba kuunganisha YSQL
Mkuu wa Mkoa asisitiza tena mikutano ya Kwa mfano, *** Kwa hivyo uhusiano wa programu ya bure sio tena kila mmoja ana nyuma ya database. Hifadhi ya pool kiwango...
Kukubali indexes ya picha ya OCI wakati wa kutatua digest iliyojengwa [skip ci]
Picha zinasukumwa kama indexes ya picha ya OCI, kwa hivyo kuuliza Usajili wa moja Picha inaonyesha tu jibu la 404, digest ilirudi tupu na hundi kushindwa kuwa w...
Kuanza wakati wa kujenga sawa majani majani pods juu ya digest zamani [skip ci]
Hatua ya rollout ilijaribu kuchunguza upya kwa kulinganisha Maoni ya picha kabla na baada ya kuweka picha. “Ni wazi kuwa Tayari ametumia k8s/deployment.yaml (pi...
Jaribu kuweka kwa digest, si kwa tag
Ahadi ya awali inaacha "kuweka picha" kuwa kimya hakuna-op. Hii inathibitisha kuwa matokeo: baada ya rollout, tag ni kutatuliwa kwa digest katika Usajili na Vio...
Ujenzi wa mradi huo haukuleta chochote na uliripoti mafanikio
Picha ni tagged na SHA ahadi, hivyo kujenga upya ahadi hiyo kuzalisha Mfano wa picha sawa. "Kuweka picha" kisha hakuna mabadiliko, Kufukuzwa ni kamwe kuguswa, '...
Lock every cron job that moves money, and run two pods
KamoLOS ran one pod and its ten cron jobs were correct only because of it. There is no ShedLock anywhere on this platform, so a second replica would have run ea...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Pin kamo-shared-library 1.6.0
The library moved to 1.6.0 while every consumer stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Enable ProxyHmacFilter — step 2, X-Org-Id is now a proven header
los.proxy-hmac.enabled has been falling through to its false default since this service deployed, so ProxyHmacFilter existed and never ran. X-Org-Id — the heade...
Scope statements, draws and payments to the caller's organization
Same bug as LoanController.get(uid), repeated: these controllers took a loan id off the path and handed it to a repository, so GET /api/los/statements/by-loan/4...
A loan id is not a credential — scope every LoanController read to the org
LoanController.get(uid) took a loan id and returned whatever it found. Any caller who reached the service got the loan, balances and borrower included, whicheve...
Rebuild against shared-library @Lob LONGVARCHAR fix
Hibernate's PostgreSQL dialect read @Lob String columns as OIDs via getLong(). Affects notes, contacts, calendar, OAuth tokens, IMAP passwords, email campaign b...
Point at YugabyteDB and use PostgreSQLDialect
CockroachDB has been replaced by YugabyteDB. Connection strings move from cockroachdb-public:26257 to yb-tserver-service:5433, and the Hibernate dialect from **...
Retry the shared-library build, which the LAN uplink keeps corrupting
Three builds died today on "Tag mismatch" pulling a jar — and the mirror added an hour ago did not help, because kbservice, mcpgatewayservice and ragservice hit...
Mirror Maven Central through the Google GCS copy
Every Docker stage starts from a cold ~/.m2 and refetches the whole dependency tree, so Central sees the full weight of every concurrent service build. It answe...
Declare security matchers explicitly before the next build breaks startup
kamo-shared-library 1.5.0 was republished today with spring-ws-core as a new transitive dependency, so Spring Boot now auto-registers a second servlet (MessageD...
Kuchochea kubectl download dhidi ya flaky egress [skip ci]
dl.k8s.io juu ya egress ya mkimbiaji hupungua katikati ya uhamisho: curl: (56) OpenSSL SSL read: decryption kushindwa au rekodi mbaya ya Mac ambayo inashindwa k...
Fix kubectl-cache find aborting under set -e + point at unified cluster
- CACHED_KUBECTL=$(find ... | head -1) aborted deploy_k1m1 under set -e/pipefail when the runner .cache/act dir is absent (never reached the curl-install fall...
Ondoa waya wa MLOS-backbone - KamoLOS ni loans binafsi waliopotea, sio MLOS
Kazi ya MLOS (mortgage) haipaswi kugusa KamoLOS ( mikopo ya kibinafsi). Pamoja-lib com.kamo.z.shared.mlos. * substrate inakaa (generic, gated mlos.outbox.enable...
Adopt MLOS transactional outbox (producer path)
Inawezesha tukio la Awamu-0 uti wa mgongo katika KamoLOS: inaongeza com.kamo.z.shared.mlos.event kwa @EnableJpaRepositories scan, mlos. * config (mlos.outbox.en...
Clone pamoja-lib na GIT CLONE TOKEN (si ishara ya Usajili)
Ishara ya Usajili inathibitisha usajili wa K1m1 Docker (htpasswd), sio kwa Forgejo git, hivyo pamoja-lib clone alishindwa auth. Tumia ishara ya Forgejo Git kama...
Build on k1m1 — clone shared-lib from k1m1, drop k2m1, fix image host
CI cloned kamo-shared-library kutoka wastaafu k0m1:3000 Forgejo, hivyo kujenga kushindwa na huduma ya los haijawahi kusukuma kwenye Usajili wa K1m1; ilinusurika...
Per-offer overrides for rate, APR, and origination fee
LoanOfferCreateRequest gains three optional fields — interestRateBpsOverride, aprBpsOverride, originationFeeAmountOverride. createDraft applies them when set an...
Default empty STRIPE_CONNECT_WEBHOOK_SECRET so KamoLOS boots
The configmap referenced **************** without a default, so Spring's placeholder resolver threw before reaching the Java-level **************** which alread...
Track shared-lib LoanRepository → PersonalLoanRepository rename
Updates every import and field type from LoanRepository to PersonalLoanRepository across 20 KamoLOS source files + 1 test (Lombok-injected field names stay as l...
Tier 6+7+9+10 — frontend polish, org reports, OpenAPI, JaCoCo
T6 (frontend polish): - New /lib/format.ts: locale-aware formatCurrency / formatDate / formatDateTime / formatPercentBps via Intl APIs (replaces hardcoded t...
Tier 4 — LoanPaymentPostingService unit tests
Six mocked-repository unit tests covering the heart of the payment posting: - **************** payment of $100 against loan with $25 fees / $50 interest / la...
Tier 5 compliance batch
- OfacSanctionsService: Jaro-Winkler fuzzy match @ ≥0.92 after exact-match pass. Hits surface similarity score. Configurable via los.ofac.fuzzy-threshold. - A...
Tier 3 security + Tier 8 bug cleanup batch
T3 — Security: - New RateLimitFilter (Bucket4j): 1000/min per IP for webhooks, 10/min per session for offer accept/decoder/rescind, 60/min general. Register...
Tier 2 — Hikari + RestTemplate timeouts + Stripe SDK + Redis cache
- RestClientConfig: single shared RestTemplate bean with 5s connect / 30s read timeouts. MediaServiceClient / NotificationDispatchService / OfacSanctionsSer...
Tier 1 critical correctness pass
T1.1 Stripe disbursement strategy: TREASURY (stub — requires SDK upgrade or raw HTTP) / CONNECTED_ACCOUNT (Transfer.create — works in SDK 28.2.0) / MA...
Final batch — compliance, packets, adjustments, Grafana, tests
Compliance: - MlaCheckService — Military Lending Act covered-borrower lookup against DoD MDC single-record query. Returns NotCovered if unconfigured so dev ...
P2 batch — observability, tests, year-end tax, real Stripe IDs
Observability: - micrometer-registry-prometheus on the classpath - /actuator/prometheus exposed via management config (both local + k8s configmap) - LoanMetrics...
P1 batch — webhooks advance state, crons, commerce vertical
Money movement (the core P1): - LoanPaymentPostingService: markSucceededAndPost / markFailed / markReturnedAndReverse / markDisbursementSucceeded / markDrawDi...
P0 hardening — Stripe Connect endpoint + PDF flatten
- Fix EsignClient imports: EsignGenericEnvelopeRepository / EsignSignatureRepository live in .esign.repos, not .esign root - New StripeConnectController POST ...
Initial personal-loan origination + servicing service
New Spring Boot 3.1.5 / Java 21 microservice modeled on BillingService. Owns personal-loan domain end-to-end: - LoanProduct / LoanOffer / Loan CRUD with REST +...
Hide isActive=false programs from borrowers in real time
useProgramCatalog now filters out programs with isActive=false before returning them to the loan wizard. The flag is computed server-side as (base.isActive AND ...
Drive journey sky from SkyToggle, unstack from personality chip
- Move SkyToggle to its own top-right row at top-14 so the slider stops overlapping LoGuideChip, which is positioned at right-14 assuming it only needs to c...
Je, unaona nini kuhusu usafiri?
Kila kitu kinaingia kwenye tovuti yako mwenyewe. Anza kwenye mpango wa bure na usome ukurasa huu tena katika mwezi mmoja.